From d6f4155e391dec67bb9163b618fc6efbbcaf1659 Mon Sep 17 00:00:00 2001 From: Pierre Schweitzer Date: Fri, 25 Feb 2011 20:15:51 +0000 Subject: [PATCH] [NTOSKNRL] For both FsRtlIsNameInExpression() & FsRtlIsDbcsInExpression(): As both UNICODE_STRING & ANSI_STRING might not be NULL-termined, don't attempt to read null char. This fixes potential buffer overruns. Then it fixes some (all?) 'TempPte.u.Long != 0' assertion failure. See issue #5923 for more details. svn path=/trunk/; revision=50904 --- reactos/ntoskrnl/fsrtl/dbcsname.c | 17 +++++++++++------ reactos/ntoskrnl/fsrtl/name.c | 23 ++++++++++++++--------- 2 files changed, 25 insertions(+), 15 deletions(-) diff --git a/reactos/ntoskrnl/fsrtl/dbcsname.c b/reactos/ntoskrnl/fsrtl/dbcsname.c index 202c2a3faca..2bf4af91b37 100644 --- a/reactos/ntoskrnl/fsrtl/dbcsname.c +++ b/reactos/ntoskrnl/fsrtl/dbcsname.c @@ -185,10 +185,15 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression, break; case '?': - ExpressionPosition++; + if (++ExpressionPosition == Expression->Length) + { + NamePosition = Name->Length; + break; + } + MatchingChars = NamePosition; - while (Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition] && - NamePosition < Name->Length) + while (NamePosition < Name->Length && + Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition]) { NamePosition++; } @@ -200,7 +205,7 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression, break; case ANSI_DOS_DOT: - while (Name->Buffer[NamePosition] != '.' && NamePosition < Name->Length) + while (NamePosition < Name->Length && Name->Buffer[NamePosition] != '.') { NamePosition++; } @@ -246,8 +251,8 @@ FsRtlIsDbcsInExpression(IN PANSI_STRING Expression, else if (StarFound != MAXUSHORT) { ExpressionPosition = StarFound + 1; - while (Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition] && - NamePosition < Name->Length) + while (NamePosition < Name->Length && + Name->Buffer[NamePosition] != Expression->Buffer[ExpressionPosition]) { NamePosition++; } diff --git a/reactos/ntoskrnl/fsrtl/name.c b/reactos/ntoskrnl/fsrtl/name.c index ecb2c3ff6a4..8ed32a34b4b 100644 --- a/reactos/ntoskrnl/fsrtl/name.c +++ b/reactos/ntoskrnl/fsrtl/name.c @@ -45,11 +45,16 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression, break; case L'?': - ExpressionPosition++; + if (++ExpressionPosition == Expression->Length / sizeof(WCHAR)) + { + NamePosition = Name->Length / sizeof(WCHAR); + break; + } + MatchingChars = NamePosition; - while ((IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] : - Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition] && - NamePosition < Name->Length / sizeof(WCHAR)) + while (NamePosition < Name->Length / sizeof(WCHAR) && + (IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] : + Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition]) { NamePosition++; } @@ -61,8 +66,8 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression, break; case DOS_DOT: - while (Name->Buffer[NamePosition] != L'.' && - NamePosition < Name->Length / sizeof(WCHAR)) + while (NamePosition < Name->Length / sizeof(WCHAR) && + Name->Buffer[NamePosition] != L'.') { NamePosition++; } @@ -108,9 +113,9 @@ FsRtlIsNameInExpressionPrivate(IN PUNICODE_STRING Expression, else if (StarFound != MAXUSHORT) { ExpressionPosition = StarFound + 1; - while ((IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] : - Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition] && - NamePosition < Name->Length / sizeof(WCHAR)) + while (NamePosition < Name->Length / sizeof(WCHAR) && + (IgnoreCase ? UpcaseTable[Name->Buffer[NamePosition]] : + Name->Buffer[NamePosition]) != Expression->Buffer[ExpressionPosition]) { NamePosition++; }